CVE-2022-43959

CVE-2022-43959 Bitrix Vulnerability CVE-2022-43959 Description Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 AD/LDAP connector module before version 23.100.0 allow remote administrators to discover an AD/LDAP administrative password by reading the sourc...

threat-research-and-intelligence

Full Intelligence Blogs | Blog Outcomes | Report Outcomes | Public Talks ℹ️ :: Overview This repository is for the dissemination of IOCs, YARA rules and source code from threat intelligence reports published by the BlackBerry Threat Research & Intelligence team. For fully detailed reports includin...

Vulnerability-Assessment-and-OSINT-CVE-2012-1823

Vulnerability Assessment and OSINT: CVE-2012-1823 My repository documents the process of identifying, analyzing, and gathering Open Source Intelligence OSINT on a specific security vulnerability detected during a target network scan. Overview of the Process The workflow carried out across this...

Myesve

myesve CVE-2024-38475 Exploitation Framework – Version 1.0 Disclaimer: This tool is intended for authorized security testing, educational research, and legitimate bug bounty programs only. Do not use it against systems you do not own or lack explicit permission to test. The authors assume no...

rats-re

Rats! source reconstruction with local LLMs This repository is a work-in-progress reconstruction of the source code for RATS.EXE, the original Windows version of Rats! 1994 by Sean O'Connor. It builds a Win32 executable with Microsoft Visual C++ 4.1 under wibo and can be tested in DREAMM. The...

CVE-2026-22686

Enclave VM Sandbox Escape CTF Challenge Challenge: "Breaking the Walls" Difficulty: Hard Category: Source Code Review / Sandbox Escape Points: 500 Scenario You've discovered a mysterious sandboxed JavaScript execution environment...

PT-2026-134514

Name of the Vulnerable Software and Affected Versions WebDyne versions 2.022 through 3.021 Description Unauthenticated clients can access application source code through the viewer on the default index page. Wrapper scripts, such as webdyne.psgi, enable this index page by default. The source view...

chall.stypr.com

chall.stypr.com Thank you for playing chall.stypr.com It has been nine years since I initially set up and hosted my wargame. Many CTFs have now already re-used or made similar challenges, so I've decided to share the sourcecode of all challenges and configurations used to host the challenge...

CVE-2024-40275_Scanner

CVE-2024-40725 Scanner A Python-based detection tool for CVE-2024-40725 , an Apache HTTP Server source code disclosure vulnerability affecting versions 2.4.0 and 2.4.61. Legal notice: Only run this scanner against servers you own or have explicit written authorization to test. Unauthorized use ma...

cve-2021-41773-source-code-analysis

Apache HTTP Server CVE-2021-41773 Source Code Analysis A Python-based static patch analysis tool for studying the root cause and remediation of CVE-2021-41773 Apache HTTP Server Path Traversal by comparing the vulnerable Apache HTTP Server 2.4.49 source code with the patched 2.4.51 implementation...

CVE-2023-38408

CVE-2023-38408 Slide and source code for CS-782 attack presentation...

DevAudit

Note : DevAudit uses the OSS Index database, which has some rate limiting. If you notice you are hitting the limit please raise an issue. Authenticated users get a higher limit, and we am implementing authentication into DevAudit soon. Most non-authenticated users probably won't notice the limit...

CVE-2022-2712

In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed...

Cobra

Cobra This project's design can no longer meet current white-box scanning requirements. It is no longer maintained and is intended for research use only. Please do not use it in a production environment. Introduction Cobra is a source code security audit tool that supports detecting most prominen...

CVE-2026-85297

Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform are vulnerable to a Bucket Squatting attack. This vulnerability allows an attacker to intercept and access proprietary source code , execute arbitrary code , and exfiltrate data , potentially leading to service account takeove...

CVE-2026-85297 Bucket Squatting in Cloud Run MCP leads to Service Account Takeover

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data. Users must upgrade to Cloud Run MCP version 1.11.0 or later...

CVE-2026-85297 Bucket Squatting in Cloud Run MCP leads to Service Account Takeover

Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data. Users must upgrade to Cloud Run MCP version 1.11.0 or later...

Google Cloud Run MCP encryption issue vulnerability

Versions of Google Cloud Run MCP prior to 1.11.0 contain an encryption-related vulnerability stemming from bucket preemption. This may allow attackers to intercept and access proprietary source code, execute arbitrary code, and exfiltrate data...

NameTrap: Steering AI Coding Agents toward Security Vulnerabilities Via Variable Names

AI coding agents routinely clone repositories, install packages, and read source code obtained from the Web, so publicly hosted code becomes part of the context that shapes the code they write. We show that this Web-borne context can be weaponized without any explicit instruction. We present...

Enhancing LLM-Based Vulnerability Detection Via Representation-Aware Logical Ensemble

Automated vulnerability detection in C source code is a long-standing challenge, as traditional static analysis tools often trade precision for scalability and struggle with complex vulnerability patterns. Recently, large language models LLMs have shown promising results; yet, most approaches rel...